Financial institutions have operated for hundreds of years, and while the way banking is conducted has shifted dramatically, the core principles remain consistent. Banks have always managed large volumes of customers’ personal and financial details.
The rapid expansion of financial technology has driven numerous changes and innovations over the past several decades—ranging from wire transfers and credit/debit cards to online banking and mobile payment platforms. To keep up, banks have been forced not only to modernize their technical systems but also to rethink their internal procedures so that security remains intact while adopting new technologies. Safeguarding sensitive data and deploying protective measures against cybercriminal activities such as phishing and malware have become non-negotiable priorities.
At the same time, banking regulations continue to evolve in response to the demands of modern financial systems. Institutions are legally bound to secure customer data and defend it from both cyberattacks and unauthorized access. This article explores how today’s banks and financial service providers meet that obligation.
Key Figures: How the Cyber Threat Landscape Is Changing in 2026
Cyber threats continue to evolve at both global and regional levels. Attackers exploit vulnerabilities across the attack surface, ransomware remains a significant factor in security incidents, and artificial intelligence is accelerating various stages of cyberattacks.
Global
The Verizon 2026 Data Breach Investigations Report (DBIR) which examines data breaches from 2025, highlights several notable findings:
- 31% of breaches began with the exploitation of software vulnerabilities. For the first time in the DBIR’s 19-year history, vulnerability exploitation became the most common initial attack vector, surpassing the use of stolen credentials;
- Ransomware was involved in 48% of breaches, compared with 44% in the previous report published in 2025;
- AI was documented as being used to enhance 15 different attack techniques, spanning various stages of the attack lifecycle, from target identification and initial access to malware development;
- In phishing simulations, mobile-based scenarios involving text messages and phone calls achieved a 40% higher successful click-through rate than traditional email phishing;
According to the IBM Cost of a Data Breach Report 2026 AI was used in one out of every four malicious data breaches. IBM also reported a 56% year-over-year increase in such attacks. Examples include deepfake impersonation and AI-generated malware. The average cost of a data breach in the financial sector reached approximately $6.3 million.
It is important to note that Verizon and IBM use different research methodologies. Therefore, these figures should be considered separate indicators of evolving cyber threats rather than directly comparable statistics.
Regional Context: Cybersecurity Requirements Are Becoming Stricter
Across the Caucasus, Central Asia, and Moldova, the development of digital financial services is accompanied by growing regulatory attention to information security, risk management, and the resilience of banking operations.
Georgia (Sakartvelo)
Recent reports from the National Bank of Georgia indicate that the financial sector faces phishing and distributed denial-of-service (DDoS) attacks. Phishing attacks aim to steal user information, while DDoS attacks seek to disrupt the availability of banking services.
The National Bank of Georgia regularly assesses commercial banks’ compliance with cybersecurity requirements, analyzes incident reports, and facilitates the exchange of information about emerging threats. Particular attention is paid to data protection, third-party risks, and banks’ preparedness for cyberattacks.
Overall, Georgia continues to strengthen cybersecurity oversight in its financial sector.
Azerbaijan
In 2024, more than 814 million attempts to access government resources were blocked through AzStateNet. Security assessments also identified vulnerabilities in 857 government resources. These figures illustrate the scale of cybersecurity challenges facing the public sector, although they do not, on their own, demonstrate an increase in the number of cyberattacks worldwide.
On June 2, 2026, Azerbaijan established the National Cybersecurity Agency to oversee compliance with cybersecurity requirements and coordinate activities in this area. However, the agency’s authority has certain limitations. In matters involving critical infrastructure and government information systems, some of its responsibilities are limited to information exchange.
Cybersecurity in the financial sector is overseen by a dedicated team, FinCERT, operating under the Central Bank of Azerbaijan. It collects and analyzes incident reports, alerts financial institutions to emerging threats, and helps coordinate responses to cyberattacks.
The Central Bank has also established a working group to combat digital payment fraud. The group brings together representatives of law enforcement agencies, banks, and payment service providers. Its members exchange information to improve fraud detection and prevent future incidents.
As a result, Azerbaijan’s cybersecurity framework relies on several interconnected elements: a national cybersecurity agency, specialized response teams, and cooperation with the financial sector.
Moldova
Since March 20, 2025, Moldova has enforced an updated National Bank regulation covering information technology risks, information security, and business continuity.
In 2026, the regulator plans to assess how banks comply with these requirements. Key areas of focus include vulnerability management, protection of critical systems, cybersecurity incident preparedness, and risks associated with IT service providers.
In December 2025, the National Bank of Moldova fined EnergBank MDL 3.13 million. The identified violations included deficiencies in IT risk management and information security, as well as risks to the confidentiality and integrity of databases supporting critical systems. The regulator also identified other shortcomings, including inadequate credit risk assessment.
Moldova is thus strengthening its financial sector’s cybersecurity not only by introducing new requirements but also by monitoring how banks implement them.
Kazakhstan
In 2025, the Agency for Regulation and Development of the Financial Market conducted information security inspections covering:
- 23 banks;
- 17 financial institutions.
Following these inspections, nine banks received written orders to address identified deficiencies, while one bank was fined. Another 24 financial institutions were also issued orders to remediate violations.
Requirements for mobile banking were also tightened, with new regulations taking effect on November 1, 2025.
In spring 2026, the Agency approved five additional resolutions. These establish requirements for protecting banking systems, ensuring business continuity, and reporting vulnerabilities, disruptions, and security incidents to the regulator.
Kazakhstan continues to strengthen financial sector cybersecurity through a combination of updated regulations, inspections, and information sharing.
Banking Sector: Data Remains a Primary Target
Banking systems process large volumes of personal, payment, financial, and corporate data, making information protection an essential component of cybersecurity resilience in the financial sector.
However, risks extend beyond external cyberattacks. Social engineering, compromised user accounts, excessive third-party access privileges, insecure data transfer channels, and the use of unauthorized digital tools by employees also pose significant threats.
The growing adoption of generative artificial intelligence introduces additional risks. Employees may share document excerpts, customer information, or internal corporate data with external AI services. Meanwhile, AI agents connected to corporate systems may access multiple data sources simultaneously, including CRM systems, file repositories, databases, and email.
Banks must therefore understand where sensitive data is stored, who can access it, and which channels could allow it to leave the controlled environment.
Under these conditions, data protection requires a comprehensive approach, ranging from access management and user activity auditing to data transfer controls and secure AI adoption. The following sections outline practical measures that can help banks reduce the risk of data breaches and strengthen information security.
Best Practices for Banking Data Security
Ensuring the protection of sensitive data requires banks to adopt a comprehensive, 360-degree security strategy that prevents breaches from both internal and external sources. This includes securing the customer-facing side of operations as well as internal processes involving employees, vendors, and systems. Below are six proven approaches banks can implement to achieve stronger data protection.
1. Authentication
Every banking transaction must begin with the confirmation of the individual’s identity. This principle applies to customers logging into online or mobile banking platforms, those visiting a physical branch, and users conducting transactions with credit or debit cards at ATMs or POS terminals. It is equally relevant for employees who access institutional or customer data. In the past, authentication required only an ID paired with a password or PIN. Today, many banks enforce two-factor or multi-factor authentication to verify that the individual is genuinely who they claim to be. Biometric methods are also widely introduced, including behavioral biometrics that track user patterns when interacting with services such as Interactive Voice Response (IVR) systems. These layers of verification play a central role in an institution’s broader information security framework.
2. Audit Trails
Traditionally, a record of transactions was provided via statements or passbooks. Modern systems now maintain detailed audit logs of every event during a customer’s interaction. Such trails are crucial for fast responses to incidents such as data breaches or ransomware attacks. Whether through phone banking or online platforms, both the timestamp and activity details are recorded. These logs are backed up on a daily basis and never entirely erased; instead, they are archived according to defined intervals. Maintaining a tested response plan for potential incidents is a standard component of effective audit trail management.
3. Secure Infrastructure
Protecting infrastructure includes securing the servers and databases where information resides and implementing boundaries around them. Within core banking systems, production data is typically encrypted. Access to production environments is strictly limited to authorized personnel, with critical infrastructure managed only by trusted providers. Effective access control remains the cornerstone of safeguarding these resources. When testing is required, sensitive information such as account numbers, customer names, and addresses must be masked. In most institutions, the vendors responsible for infrastructure differ from those managing applications. Employees are provided with hardened devices that block social media, personal email, and USB access. When staff connect over public Wi-Fi, they may only access the bank’s network via VPN.
4. Secure Processes
Banks implement numerous processes to guarantee that security measures are properly deployed and regularly assessed. Examples include mandatory Know Your Customer (KYC) updates, non-disclosure agreements (NDAs) for employees and vendors, and the creation of restricted zones within offices and remote data centers.
By leveraging Data Loss Prevention (DLP) solutions, banks can limit insider risks and protect customers’ sensitive data such as names and credit card information. DLP tools also help financial institutions comply with major regulatory frameworks like PCI DSS and GDPR, ensuring that their security posture meets industry standards and preserves client trust.
In addition, risk assessments are routinely performed to align all procedures with both global and local compliance requirements.
5. Data Protection When Using AI
As artificial intelligence becomes more widespread, banks are encountering AI not only as a component of cyberattacks but also as a technology increasingly integrated into their operations. Financial institutions are deploying large language models (LLMs), enterprise Model Context Protocol (MCP) servers, and internal AI agents to analyze data, automate operational processes, support employees, and interact with internal systems.
However, requests submitted to AI agents may contain confidential information, including customers’ personal data, financial records, internal documents, and other sensitive business information. Additional risks emerge when AI agents use MCP connections to access corporate systems, databases, file repositories, and other information sources. Protecting information shared with AI agents and their connected tools should therefore become a dedicated component of a bank’s information security strategy.
DLP solutions help monitor the data employees and corporate systems transfer to AI tools and prevent unauthorized disclosure of confidential information. This is particularly important for internal AI agents that can simultaneously access multiple corporate data sources, including CRM systems, file repositories, databases, email, and other enterprise applications.
Data controls at the endpoint and transfer-channel levels can help reduce the risk of information leakage through AI prompts, MCP-related interactions, and other AI communication channels, where those channels are covered by the organization’s security controls.
These measures also support compliance with internal security policies and data protection requirements.
6. Continuous Communication
In addition to sending out periodic account statements, banks maintain regular communication with their clients about system upgrades, new authentication practices, and other security developments. Customers are able to configure transaction limits and alerts, helping them stay informed about unusual or suspicious account activity. Multiple channels are offered for these updates, with flexible setups to maximize convenience for the end user.
Reinforcing Data Protection with Netwrix Endpoint Protector
Applying these five practices greatly enhances the security of financial and personal data within banks. However, deploying specialized security technologies is equally vital. Netwrix Endpoint Protector delivers a comprehensive Data Loss Prevention solution built to address the unique challenges of both the banking industry and the wider financial sector.
The platform helps prevent operational disruptions, compliance violations, penalties, and reputational harm associated with endpoint data breaches. By continuously monitoring and controlling the handling of sensitive information—such as personally identifiable information (PII) and payment records—Netwrix Endpoint Protector reduces the risks of insider threats and data loss caused by malicious intent, negligence, or compromised accounts.
One of the key advantages of Netwrix Endpoint Protector is its combination of advanced content inspection and data transfer control capabilities:
- AI data protection: Monitoring and controlling information employees share with AI and LLM tools, including prompt text and files uploaded to AI agents.
- Source code protection: Recognizing dozens of programming languages to help safeguard proprietary source code, particularly in financial institutions with in-house development teams.
- Deep Packet Inspection (DPI): Inspecting network traffic content to detect and block unauthorized transfers of confidential information.
- Optical Character Recognition (OCR): Detecting sensitive information and source code within images and scanned documents.
- Data transfer channel control: Protecting information transferred through USB devices, web applications, cloud services, email, clipboards, and other channels.
- Context-aware DLP policies: Applying different security rules based on data type, user, device, application, or transfer channel.
- Granular policy configuration: Defining security settings for user groups, individual users, and specific endpoints.
Netwrix Endpoint Protector helps banks and financial services organizations fulfill compliance obligations under frameworks such as GDPR, CCPA, PCI DSS, GLBA, and others. It also ensures continued oversight of employee endpoints—even when teams are working remotely or offline.
